PT-2024-2767 · Envoy+1 · Envoy+1
Alhuan
·
Published
2024-02-09
·
Updated
2024-04-23
·
CVE-2024-23324
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Envoy versions prior to 1.26.7
Envoy versions prior to 1.27.3
Envoy versions prior to 1.28.1
Envoy versions prior to 1.29.1
Description
The issue exists due to insufficient input validation in the Envoy proxy server, allowing remote attackers to bypass the authentication process. Downstream clients can force invalid gRPC requests to be sent to ext authz, circumventing ext authz checks when failure mode allow is set to true.
Recommendations
For versions prior to 1.26.7, upgrade to version 1.26.7 or later.
For versions prior to 1.27.3, upgrade to version 1.27.3 or later.
For versions prior to 1.28.1, upgrade to version 1.28.1 or later.
For versions prior to 1.29.1, upgrade to version 1.29.1 or later.
As a temporary workaround, consider setting failure mode allow to false to prevent bypassing ext authz checks.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Envoy
Red Os